Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceCVE-2022-39331

CVE-2022-39331

MEDIUM4.6

Cross-site Scripting (XSS) in Nexcloud Desktop Client

Published Nov 25, 2022

Modified 5 months ago

Details

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

References

https://github.com/nextcloud/desktop/pull/4944

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c3xh-q694-6rc5

https://hackerone.com/reports/1668028

https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html

https://www.cve.org/CVERecord?id=CVE-2022-39331

CVSS Analysis

CVSS v3.1

4.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

4.6/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness Type (CWE)

Injection

Cross-site Scripting (XSS)

Ecosystems

Timeline

PublishedNov 25, 2022

ModifiedNov 3, 2025

CVE-2022-39331 | Mondoo Vulnerability Intelligence